Lucene search

K
huntrPopcorn9438A4B8E4-8C6E-4312-8302-13FD76F2AEC2
HistoryFeb 20, 2023 - 8:50 a.m.

Jquery UI 1.13.1 in use which is vulnerable to CVE-2022-31160

2023-02-2008:50:55
popcorn94
www.huntr.dev
568

Description

Jquery UI 1.13.1 in use which is vulnerable to CVE-2022-31160

Proof of Concept

  1. Go to https://demo.limesurvey.org/tmp/assets/15bf41ab/jquery-ui.min.js and note that jquery-ui 1.13.1 is in use.
  2. Check https://github.com/LimeSurvey/LimeSurvey/blob/master/vendor/jquery-ui/jquery-ui.min.js and note that jquery-ui 1.13.1 is in use.
  3. Go to https://security.snyk.io/vuln/SNYK-JS-JQUERYUI-2946728 and note 1.13.1 is vulnerable to CVE-2022-31160.